Tune Library Security & Risk Analysis
wordpress.org/plugins/tune-libraryImport your iTunes music list into Wordpress and display your song collection on any page.
Is Tune Library Safe to Use in 2026?
Generally Safe
Score 93/100Tune Library has a strong security track record. Known vulnerabilities have been patched promptly. It's a solid choice for most WordPress installations.
The "tune-library" v1.6.4 plugin exhibits a mixed security posture. While it demonstrates good practices such as 100% prepared statement usage for SQL queries and a moderate number of nonce and capability checks, significant concerns arise from its attack surface and taint analysis. The presence of two AJAX handlers without authentication checks represents a direct entry point for potential unauthenticated attacks. Furthermore, the taint analysis revealed one flow with unsanitized paths, classified as high severity, which could lead to various vulnerabilities if not properly handled. The plugin's vulnerability history, including a past critical CVE and a medium CVE, with the last one being in 2026, suggests a recurring tendency towards critical and injection-based vulnerabilities. This historical pattern, combined with the current high-severity taint flow and unprotected entry points, indicates a need for heightened vigilance and thorough review.
Key Concerns
- Unprotected AJAX handlers
- High severity unsanitized taint flow
- Past critical CVE
- Past medium CVE
- Insufficient output escaping
Tune Library Security Vulnerabilities
CVEs by Year
Severity Breakdown
2 total CVEs
Tune Library <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via CSV Import
Tune Library < 1.5.5 - SQL Injection
Tune Library Release Timeline
Tune Library Code Analysis
SQL Query Safety
Output Escaping
Data Flow Analysis
Tune Library Attack Surface
AJAX Handlers 2
Shortcodes 1
WordPress Hooks 10
Maintenance & Trust
Tune Library Maintenance & Trust
Maintenance Signals
Community Trust
Tune Library Alternatives
iTunes-Data
itunes-data
Displays data from an itunes xml file as a sidebar widget.
Seriously Simple Podcasting
seriously-simple-podcasting
Podcasting the way it's meant to be. No mess, no fuss - just you and your content taking over the world.
Cue by AudioTheme.com
cue
Delightful and reliable audio playlists.
Audio Album
audio-album
Displays a collection of audio tracks as an audio album using the native WordPress audio features. Includes a customizer section.
Audio Player with Playlist Ultimate
audio-player-with-playlist-ultimate
Audio Player with Playlist Ultimate is a Music/Audio Player with Playlist and options like shuffle, repeat, volume control, progress-bar, song info.
Tune Library Developer Profile
8 plugins · 11K total installs
How We Detect Tune Library
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/tune-library/chart_curve.pngHTML / DOM Fingerprints
Copyright 2020 Yannick Lefebvre (email : ylefebvre@gmail.com)
Part of XML Loading Code based on Musiker (http://code.google.com/p/musiker/) by Jarvis Badgley, re-used with permission
Thanks to Gary Traffanstedt for his help on testing, his great suggestions and with AJAX
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA<!-- IMPORTANT: If you are an author of this plugin, you must change the default plugin settings below. -->name="tune-library-options"method="post"enctype="multipart/form-data"id="tunelibrarypp-config"name="tunelibrarypp-config"